> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # ♠ Spades: Adversarial - URL: https://www.ostering.com/taxonomies/ai-agentic-systems/eoa-adversarial/ - Published: 2026-11-05T21:00:00.000Z - Updated: 2026-11-05T20:36:21.664Z - Description: Adversarial threats to AI and agentic systems: 6 Elevation of Autonomy cards with prompts, mitigation principles, design measures and mappings. - Author: Brett Crawley [Taxonomies](https://ostering.com/taxonomies/) / [AI and Agentic Systems Threat Taxonomy](https://ostering.com/taxonomies/ai-agentic-systems/) / Spades Direct attacks on the model and the agent: text that becomes an instruction, tools turned against their owner, poisoned components, memory and tool descriptions, and output that a downstream consumer trusts. This suit has 6 cards, EOA·SA to EOA·S9. In the game, high ranks (Ace, King) are the broader or more foundational threats and low ranks the more specific or variant ones; in the taxonomy the ID is a stable reference, not a severity. Each entry gives the card's threat and mitigation prompts, the mitigation principle a sound design follows, design measures, and mappings. ![Spades at a glance: each card's ID, title, quote, threat and mitigation principle. The full text is below and in the downloads.](https://www.ostering.com/media/posts/125/ai-agentic-systems-adversarial-taxonomy-table2x.png =3000x2606) ## The entries ### EOA·SA Prompt Injection > *“Anything the model reads can be interpreted as an instruction.”* **Threat.** An attacker-controlled text reaches the model's context and is interpreted as a new instruction. The injection may be direct (in the user prompt) or indirect (in retrieved content, tool output, memory, or another agent's message). The model cannot reliably distinguish instructions from data. **Mitigation prompts** (from the card) - How are inputs from each source delimited? - What happens when a retrieved document contains an instruction? - What actions are irreversible, and are any of them reachable from a single model output? **Mitigation principle.** Treat every channel into the context as untrusted, and make sure no single model output can trigger a consequential action on its own. **Design measures** - Label and delimit each source in the context (system, user, retrieved content, tool output, memory, other agents), and keep instructions and data in separate fields wherever the interface allows. - Enforce what the agent may do outside the model: authorisation at the data layer and allow-listed tool arguments, so an obeyed injection is still refused. - Require out-of-band human confirmation for destructive or externally visible actions, showing what will happen in terms the user can check. - Filter output at every sink that could become an exfiltration channel (links, images, tool arguments, outbound messages). **Mappings** - STRIDE: T, E - Card references: OWASP LLM01. ASI01 when it redirects an agent. CAPEC-242 conceptually. - MITRE ATLAS: [AML.T0051.000](https://atlas.mitre.org/techniques/AML.T0051.000) LLM Prompt Injection: Direct, [AML.T0051.001](https://atlas.mitre.org/techniques/AML.T0051.001) LLM Prompt Injection: Indirect - CAPEC: none - CWE: [CWE-1427](https://cwe.mitre.org/data/definitions/1427.html) Improper Neutralization of Input Used for LLM Prompting **Seen in the wild.** EchoLeak (CVE-2025-32711): a zero-click indirect prompt injection in Microsoft 365 Copilot, in which a crafted email led Copilot to exfiltrate data from the user's context. Disclosed by Aim Security, June 2025. Source: [Zero-click AI data leak flaw uncovered in Microsoft 365 Copilot (BleepingComputer)](https://bleepingcomputer.com/news/security/zero-click-ai-data-leak-flaw-uncovered-in-microsoft-365-copilot). **Touches:** [EOA·S10](#eoa-s10) Improper Output Handling, [EOA·S9](#eoa-s9) Tool Description Injection, [EOA·T7](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t7) Adversarial Subspace ### EOA·SK Tool Misuse > *“A legitimate tool used for illegitimate ends is still destructive.”* **Threat.** The agent invokes a legitimate, authorised tool in a way that causes harm because the arguments were attacker-influenced or the tool's blast radius was too wide. **Mitigation prompts** (from the card) - For each tool, what is the worst thing it could do with attacker-controlled arguments? - Are destructive arguments allow-listed? - Is human confirmation required for irreversible outcomes? **Mitigation principle.** Constrain what each tool can do with any argument, not only which tools the agent may call. **Design measures** - Allow-list arguments and argument ranges for tools with side effects (paths, recipients, resources, amounts), not just function names. - Give each tool its own credentials scoped to the minimum it needs, so a misused call cannot reach beyond that scope. - Require human confirmation for irreversible outcomes, and make destructive operations soft-delete or recoverable by default. - Use idempotency keys and per-tool rate limits so a repeated or looping call cannot cascade. **Mappings** - STRIDE: T, E - Card references: ASI02. OWASP LLM06 secondary. - MITRE ATLAS: [AML.T0053](https://atlas.mitre.org/techniques/AML.T0053) AI Agent Tool Invocation, [AML.T0101](https://atlas.mitre.org/techniques/AML.T0101) Data Destruction via AI Agent Tool Invocation, [AML.T0086](https://atlas.mitre.org/techniques/AML.T0086) Exfiltration via AI Agent Tool Invocation - CAPEC: none - CWE: none **Seen in the wild.** GitHub MCP "toxic agent flow": a prompt injection in a public issue led an agent using the official GitHub MCP server to pull data from the user's private repositories and leak it through a pull request in the public one. Disclosed by Invariant Labs, May 2025. Source: [GitHub MCP Exploited: Accessing private repositories via MCP (Invariant Labs)](https://invariantlabs.ai/blog/mcp-github-vulnerability). **Touches:** [EOA·HA](https://ostering.com/taxonomies/ai-agentic-systems/eoa-autonomy/#eoa-ha) Excessive Agency, [EOA·SA](#eoa-sa) Prompt Injection, [EOA·T3](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t3) Excessive Autonomy by Design ### EOA·SQ Supply Chain Compromise > *“The code you didn't write runs with the credentials you have.”* **Threat.** A component in the AI supply chain (base model, adapter, library, MCP server, prompt template) is compromised upstream or via an update. **Mitigation prompts** (from the card) - What is in your AI-BOM? - How are updates reviewed? - What does each component have access to that it does not need? **Mitigation principle.** Know every component the system's behaviour depends on, review it on every change, and give each one only the access it needs. **Design measures** - Keep an AI-BOM covering models, adapters, datasets, libraries, MCP servers and prompt templates, each with its source, version and digest. - Gate installation and every update behind review, including re-reading tool descriptions and permissions on each version bump. - Pin versions by digest and verify signatures or provenance where the publisher offers them. - Run each component, and especially each MCP server, in its own sandbox with its own identity, filesystem view and egress policy. **Mappings** - STRIDE: T, E - Card references: OWASP LLM03. ASI04. - MITRE ATLAS: [AML.T0010.001](https://atlas.mitre.org/techniques/AML.T0010.001) Supply Chain Compromise: Software, [AML.T0010.003](https://atlas.mitre.org/techniques/AML.T0010.003) Supply Chain Compromise: Model Repository, [AML.T0010.005](https://atlas.mitre.org/techniques/AML.T0010.005) Supply Chain Compromise: AI Agent Tool - CAPEC: [CAPEC-538](https://capec.mitre.org/data/definitions/538.html) Open-Source Library Manipulation - CWE: [CWE-1357](https://cwe.mitre.org/data/definitions/1357.html) Reliance on Insufficiently Trustworthy Component, [CWE-494](https://cwe.mitre.org/data/definitions/494.html) Download of Code Without Integrity Check **Seen in the wild.** Amazon Q Developer for VS Code: version 1.84.0 shipped with an injected prompt telling the agent to wipe local files and cloud resources, after an unauthorised commit reached the release; AWS says it never ran. Bulletin AWS-2025-015, July 2025. Source: [AWS-2025-015: Security Update for Amazon Q Developer Extension for Visual Studio Code (Version #1.84)](https://aws.amazon.com/security/security-bulletins/rss/aws-2025-015). **Touches:** [EOA·D9](https://ostering.com/taxonomies/ai-agentic-systems/eoa-data/#eoa-d9) Server Impersonation and Rogue Servers, [EOA·T2](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t2) Invisible Dependency, [EOA·S9](#eoa-s9) Tool Description Injection ### EOA·SJ Memory Poisoning > *“Today's lie becomes tomorrow's ground truth.”* **Threat.** An adversary causes false or malicious content to be written to long-term memory where it persists across sessions and is later retrieved as trusted context. **Mitigation prompts** (from the card) - Who can write to memory? - Is provenance attached? - Is memory partitioned per user? - How are security-relevant memory reads validated? **Mitigation principle.** Treat memory as untrusted input with provenance, never as an authority on policy or permissions. **Design measures** - Attach provenance to every memory write: who or what wrote it, in which session, from which source, with what authority. - Partition memory per user and per tenant; no cross-user writes and no shared memory without an explicit owner. - Never let memory change security-relevant state (approvals, permissions, policy); read those from the system of record every time. - Show users recent memory writes for confirmation, and audit and expire memory periodically. **Mappings** - STRIDE: T - Card references: ASI06. - MITRE ATLAS: [AML.T0080.000](https://atlas.mitre.org/techniques/AML.T0080.000) AI Agent Context Poisoning: Memory - CAPEC: none - CWE: none **Seen in the wild.** SpAIware: a prompt injection planted persistent instructions in ChatGPT's long-term memory on the macOS app, so data from later conversations was exfiltrated. Disclosed by Johann Rehberger (Embrace The Red), September 2024; fixed by OpenAI. Source: [Spyware Injection Into Your ChatGPT's Long-Term Memory (SpAIware) (Embrace The Red)](https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration). **Touches:** [EOA·SA](#eoa-sa) Prompt Injection, [EOA·CK](https://ostering.com/taxonomies/ai-agentic-systems/eoa-privacy/#eoa-ck) Retention and Removal, [EOA·HJ](https://ostering.com/taxonomies/ai-agentic-systems/eoa-autonomy/#eoa-hj) Cascading Failure ### EOA·S10 Improper Output Handling > *“The model's output is not user input, except in every way that matters.”* **Threat.** A downstream consumer treats model output as trusted, leading to exfiltration, rendering, or execution of attacker-influenced content. **Mitigation prompts** (from the card) - Which consumers of model output exist, and what do they assume? - Where is output sanitised, encoded, or structured? - Are there rendering paths that fetch remote content? **Mitigation principle.** Handle model output as untrusted input at every sink it reaches: renderer, tool argument, query, shell, log and message. **Design measures** - Encode or sanitise output for the sink it goes to (HTML, Markdown, SQL, shell, log), and never pass it to an interpreter unescaped. - Prefer structured output validated against a schema over free-form text wherever a program consumes it. - Block remote content fetches from rendered output (images, links, iframes) with a Content Security Policy or a domain allow-list. - Run any generated code in a sandbox with no network, no secrets and no access to the host filesystem. **Mappings** - STRIDE: I, T - Card references: OWASP LLM05. - MITRE ATLAS: [AML.T0077](https://atlas.mitre.org/techniques/AML.T0077) LLM Response Rendering - CAPEC: [CAPEC-63](https://capec.mitre.org/data/definitions/63.html) Cross-Site Scripting (XSS) - CWE: [CWE-79](https://cwe.mitre.org/data/definitions/79.html) Improper Neutralization of Input During Web Page Generation, [CWE-94](https://cwe.mitre.org/data/definitions/94.html) Improper Control of Generation of Code **Seen in the wild.** Google Bard data exfiltration: an indirect prompt injection in a shared Google Doc made Bard emit a Markdown image whose URL carried the user's chat history to an attacker's server. Disclosed by Johann Rehberger (Embrace The Red), November 2023; fixed by Google. Source: [Hacking Google Bard: From Prompt Injection to Data Exfiltration (Embrace The Red)](https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration). **Touches:** [EOA·SA](#eoa-sa) Prompt Injection, [EOA·DA](https://ostering.com/taxonomies/ai-agentic-systems/eoa-data/#eoa-da) Sensitive Information Disclosure, [EOA·T1](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t1) Wrong Abstraction ### EOA·S9 Tool Description Injection > *“The tool description is itself a prompt.”* **Threat.** An MCP server (or equivalent tool registry) supplies tool descriptions and parameter schemas that arrive in the model's context as instructions. A hostile or compromised server can inject prompts via the description field itself, not just the tool's return value. The "rug pull" variant mutates the description after the user has approved the tool, so the approved version and the live version diverge silently. **Mitigation prompts** (from the card) - Are tool descriptions pinned and integrity-checked between approval and use? - What happens when a server updates a description silently? - Are descriptions delimited from user prompts in the model's context? - Does any tool have a description that contains imperative language? **Mitigation principle.** Approve a tool's description and schema as code, and refuse any version that differs from what was approved. **Design measures** - Pin each tool's description and schema by hash at approval time, and block the tool (or re-prompt for approval) when the hash changes. - Review descriptions before approval for imperative language, hidden text and references to other tools or files. - Show the user the full description that the model will see, not a shortened summary. - Delimit tool descriptions from user and system content in the context, and keep them out of the system prompt. **Mappings** - STRIDE: T, S - Card references: OWASP LLM01 indirect injection. ASI01. ASI04. MCP-specific. - MITRE ATLAS: [AML.T0110.000](https://atlas.mitre.org/techniques/AML.T0110.000) AI Agent Tool Poisoning: Definition and Instructions, [AML.T0109](https://atlas.mitre.org/techniques/AML.T0109) AI Supply Chain Rug Pull - CAPEC: none - CWE: [CWE-1427](https://cwe.mitre.org/data/definitions/1427.html) Improper Neutralization of Input Used for LLM Prompting **Seen in the wild.** Tool poisoning attacks: Invariant Labs showed MCP tool descriptions carrying hidden instructions that made a client read SSH keys and configuration files and pass them out through tool arguments, including a rug-pull variant that changes after approval. April 2025. Source: [MCP Security Notification: Tool Poisoning Attacks (Invariant Labs)](https://invariantlabs.ai/blog/mcp-security-notification). **Touches:** [EOA·H9](https://ostering.com/taxonomies/ai-agentic-systems/eoa-autonomy/#eoa-h9) Confused Deputy Across Servers, [EOA·D9](https://ostering.com/taxonomies/ai-agentic-systems/eoa-data/#eoa-d9) Server Impersonation and Rogue Servers, [EOA·T2](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t2) Invisible Dependency ## Mappings at a glance ![Mappings for Spades: STRIDE, the card's references, MITRE ATLAS, CAPEC and CWE for each entry. The full text is above and in the downloads.](https://www.ostering.com/media/posts/125/ai-agentic-systems-adversarial-mapping-table2x.png =3000x1886) STRIDE across this suit: Spoofing 1, Tampering 6, Information disclosure 1, Elevation of privilege 3. 6 of 6 entries map to MITRE ATLAS, 2 to CAPEC and 4 to CWE. ## Where this suit touches the others - **[Trumps: Structural Hazards](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/)**: EOA·S10 with [EOA·T1](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t1); EOA·S9 with [EOA·T2](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t2); EOA·SA with [EOA·T7](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t7); EOA·SK with [EOA·T3](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t3); EOA·SQ with [EOA·T2](https://ostering.com/taxonomies/ai-agentic-systems/eoa-structural-hazards/#eoa-t2). - **[Hearts: Autonomy](https://ostering.com/taxonomies/ai-agentic-systems/eoa-autonomy/)**: EOA·S9 with [EOA·H9](https://ostering.com/taxonomies/ai-agentic-systems/eoa-autonomy/#eoa-h9); EOA·SJ with [EOA·HJ](https://ostering.com/taxonomies/ai-agentic-systems/eoa-autonomy/#eoa-hj); EOA·SK with [EOA·HA](https://ostering.com/taxonomies/ai-agentic-systems/eoa-autonomy/#eoa-ha). - **[Diamonds: Data](https://ostering.com/taxonomies/ai-agentic-systems/eoa-data/)**: EOA·S10 with [EOA·DA](https://ostering.com/taxonomies/ai-agentic-systems/eoa-data/#eoa-da); EOA·S9 with [EOA·D9](https://ostering.com/taxonomies/ai-agentic-systems/eoa-data/#eoa-d9); EOA·SQ with [EOA·D9](https://ostering.com/taxonomies/ai-agentic-systems/eoa-data/#eoa-d9). - **[Clubs: Privacy](https://ostering.com/taxonomies/ai-agentic-systems/eoa-privacy/)**: EOA·SJ with [EOA·CK](https://ostering.com/taxonomies/ai-agentic-systems/eoa-privacy/#eoa-ck). [Overview](https://ostering.com/taxonomies/ai-agentic-systems/) · Next: [♥ Hearts: Autonomy](https://ostering.com/taxonomies/ai-agentic-systems/eoa-autonomy/) --- *AI and Agentic Systems Threat Taxonomy v1.0, the reference for the Elevation of Autonomy card deck. © 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the [licence](https://ostering.com/taxonomies/ai-agentic-systems/#licence).*